Abstract: A method for verifying instructions communicated from a user to a relying entity is described. A trusted entity receives a request from the relying entity to verify instructions received from the user wherein the request includes verification information corresponding to the instructions communicated to the relying entity from the user. The trusted entity sends a request to the user to provide verification information corresponding to the instructions. The trusted entity receives the verification information from the user and compares it to the verification information received from the relying entity. The trusted entity then verifies the instructions based on the comparing.

Abstract: A server supporting the implementation of virtual machines includes a local memory used for caching, such as a solid state device drive. During I/O intensive processes, such as a boot storm, a “content aware” cache filter component of the server first accesses a cache structure in a content cache device to determine whether data blocks have been stored in the cache structure prior to requesting the data blocks from a networked disk array via a standard I/O stack of the hypervisor.

Abstract: Methods, systems, and computer programs manage memory of a runtime environment executing on a virtual machine. A runtime environment, such as a Java Virtual Machine, may deterministically arrange immutable data within memory such that a hypervisor may perform page sharing on the immutable data. The runtime environment may page-align the immutable data within memory. The runtime environment may further store the immutable within memory using self-referenced or self-relative pointers.

Abstract: Methods, systems, and computer programs manage memory of a runtime environment executing on a virtual machine. A controller acts as an intermediary layer between the runtime environment and outside clients. The runtime environment coordinates with the controller to “hibernate” during idle periods to more efficiently utilize memory, and to quickly “refresh” state upon receiving an access attempt. A hypervisor may perform memory page compression on one or more guest “physical” memory pages utilized by an idle runtime environment. While hibernating, the runtime environment may use a listener thread to monitor for refresh requests and awaken the runtime environment when needed.

Abstract: In a virtualized system using memory page sharing, a method is provided for maintaining sharing when Guest code attempts to write to the shared memory. In one embodiment, virtualization logic uses a pattern matcher to recognize and intercept page zeroing code in the Guest OS. When the page zeroing code is about to run against a page that is already zeroed, i.e., contains all zeros, and is being shared, the memory writes in the page zeroing code have no effect. The virtualization logic skips over the writes, providing an appearance that the Guest OS page zeroing code has run to completion but without performing any of the writes that would have caused a loss of page sharing. The pattern matcher can be part of a binary translator that inspects code before it executes.

Abstract: A source computer system with one instruction set architecture (ISA) configured to run on a target hardware system that has its own ISA. During execution from binary translation, synchronous exceptions may be either transparent (requiring processing action wholly within the target computer system) or non-transparent (requiring processing that alters a visible state of the source system, and asynchronous exceptions may also be either transparent or non-transparent, in which case an action that alters a visible state of the computer system needs to be applied. The system also includes subsystems, and related methods of operation, for detecting the occurrence of all of these types of exceptions, to handle them, and to do so with precise reentry into the interrupted instruction stream. The binary translation and exception-handling subsystems are included as components of a virtual machine monitor which is installed between the target hardware system and the source system.

Abstract: A resource scheduler for managing a distribution of host physical memory (HPM) among a plurality of virtual machines (VMs) monitors usage by each of the VMs of respective guest physical memories (GPM) to determine how much of the HPM should be allocated to each of the VMs. On determining that an amount of HPM allocated to a source VM should be reallocated to a target VM, the scheduler sends allocation parameters to a balloon application executing in the source VM causing it to reserve and write a value to a guest virtual memory (GVM) location in the source VM. The scheduler identifies the HPM location that corresponds to the reserved GVM and allocates it to the target VM by mapping a guest physical memory location of the target VM to the HPM location.

Abstract: Computer code from an application program comprising a plurality of modules that each comprise a separately loadable file is code cached in a shared and persistent caching system. A shared code caching engine receives native code comprising at least a portion of a single module of the application program, and stores runtime data corresponding to the native code in a cache data file in the non-volatile memory. The engine then converts cache data file into a code cache file and enables the code cache file to be pre-loaded as a runtime code cache. These steps are repeated to store a plurality of separate code cache files at different locations in non-volatile memory.

Abstract: A system for identifying an exiting process and removing traces and shadow page table pages corresponding to the process' page table pages. An accessed minimum virtual address is maintained corresponding to an address space. In one embodiment, whenever a page table entry corresponding to the accessed minimum virtual address changes from present to not present, the process is determined to be exiting and removal of corresponding trace and shadow page table pages is begun. In a second embodiment, consecutive present to not-present PTE transitions are tracked for guest page tables on a per address space basis. When at least two guest page tables each has at least four consecutive present to not-present PTE transitions, a next present to not-present PTE transition event in the address space leads to the corresponding guest page table trace being dropped and the shadow page table page being removed.

Abstract: A business environment on a mobile device can be controlled by an enterprise server by receiving identifying information transmitted from a mobile device, wherein the identifying information identifies a user of the mobile device to the enterprise server. A virtual phone template is transmitted to the mobile device, wherein the virtual phone template (i) corresponds to the identifying information, and (ii) is configured to provide the business environment on the mobile device as a virtual machine running on a hypervisor installed on top of a host operating system of the mobile device. The enterprise server then receives a periodic transmission from the mobile device to indicate that the mobile device remains in periodic communication with the enterprise server.

Abstract: A resource scheduler for managing a distribution of host physical memory (HPM) among a plurality of virtual machines (VMs) monitors usage by each of the VMs of respective guest physical memories (GPM) to determine how much of the HPM should be allocated to each of the VMs. On determining that an amount of HPM allocated to a source VM should be reallocated to a target VM, the scheduler sends allocation parameters to a balloon application executing in the source VM causing it to reserve and write a value to a guest virtual memory (GVM) location in the source VM. The scheduler identifies the HPM location that corresponds to the reserved GVM and allocates it to the target VM by mapping a guest physical memory location of the target VM to the HPM location.

Abstract: A graphical user interface to provision business environments on mobile devices presents a navigation panel that displays a virtual phone template menu item and a policy setting menu item. Upon selection of the virtual phone template menu item, a template user interface is presented that enables an administrator to customize virtual phone image templates for users to be delivered to mobile devices that are configured to run the virtual phone image templates as virtual machines on the mobile devices in order to provide a business environment. Upon selection of the policy setting menu item, a policy user interface is presented that enables the administrator to set security policies, wherein each of the security policies specifies a time interval within which a mobile device running a virtual machine corresponding to one of the virtual phone image templates should communicate with an enterprise server to comply with the security policy.

Abstract: One embodiment of the present invention provide a system for providing exclusive access to a virtual private network (VPN) connection to an authorized application. During operation, the system creates a unique network namespace that is different from a default network namespace of a host system. The system then places a pseudo network interface associated with the VPN connection into the unique network namespace. Furthermore, the system places at least one socket for an authorized application into the unique network namespace. The system also precludes unauthorized applications on the host from accessing the unique network namespace, thereby facilitating exclusive access to the VPN connection by the authorized application.

Abstract: A virtual business mobile device can be provisioned on a personal mobile device, by binding a mobile application for provisioning the business mobile device to a privileged component of a host operating system of the personal mobile device, wherein the binding enables a hypervisor component and a management service component of the mobile application to execute in a privileged mode. The mobile application is then able to download a virtual phone image for the business mobile device and security-related policy settings relating to use of the business mobile device from a mobile management server, wherein the hypervisor component is able to launch a virtual machine for the business mobile device based on the virtual phone image. Once the virtual phone image has been downloaded, the management service component initiates a periodic attempt to establish a connection with the mobile management server to comply with the downloaded security-related policy settings.

Abstract: Methods and systems for utilizing local storage of host computers to emulate a centralized storage system comprise receiving a write operation from a virtual machine running on a first host computer, wherein the write operation corresponds to a disk image that is locally stored in a first host computer. The disk image and a second disk image is updated in accordance with the write operation, wherein (i) the second disk image is locally stored on a second host computer that is networked to the first host computer, (ii) the second disk image serves as a back-up to the disk image, and (ii) the second host computer is configured to support the running of other virtual machines that access other disks images that (a) are locally stored on the second host computer, and (b) are further backed-up on at least a third host computer.

Abstract: Methods and system for adding a data record to a file comprise maintaining a data structure to track locations of data records within the file, wherein each entry in the data structure is a Bloom filter that corresponds to a different portion of the file that includes a plurality of data records. When an instruction to write data to the file is received, a data record is generated to append to the file, wherein the data record comprises a randomized unique id and the data from the received instruction. A Bloom filter bit pattern is extracted from the randomized unique id and bits in a current Bloom filter entry of the data structure are set, wherein the set bits correspond to the same bit positions as the Bloom filter bit pattern. The data record is thus able to be added to the file.

Abstract: A computer device (200) includes a deployment unit (220) which deploys an application program (100) into a runtime execution environment (203) based on configuration information from a plurality of configuration files (120), including at least one base configuration file (122) and one or more supplementary configuration files (123), wherein a merge unit (220) uses the one or more supplementary configuration files (123) to act upon and modify the configuration information provided in the base configuration file (122). A method of providing configuration files in a computer device (200) includes modifying configuration information provided in the base configuration file (122) using the one or more supplementary configuration files (123) to provide a merged configuration file (124), and deploying the application program (100) into the runtime execution environment (203) based on configuration information from the merged configuration file (124).

Abstract: A method of determining compatibility of a virtual machine or virtual machine disk file with a host, including a storage host, is disclosed. A lookup matrix is created to provide a fast compatibility lookup. To create the lookup matrix, computing object properties are retrieved from each of the plurality of computing objects. The computing object properties include resource requirements of each of the plurality of computing objects. Further, host properties are retrieved from each of the plurality of hosts. The method further includes creating host logical groups of a subset of the plurality of hosts having substantially same host properties and creating a plurality of computing object logical groups of a subject of the plurality of computing objects having substantially same computing object properties. The lookup matrix answers whether each member of a selected computing object logical group can be transferred to a selected host logical group.

Abstract: An analytics engine receives real-time statistics from a set of virtual machines supporting a line of business (LOB) application. The statistics relate to computing resource utilization and are used by the analytics engine to generate a prediction of demand for the LOB application in order to dynamically control the provisioning of virtual machines to support the LOB application.

Abstract: In a computer system supporting execution of virtualization software and at least one instance of virtual system hardware, an interface is provided into the virtualization software to allow a program to directly define the access characteristics of its program data stored in physical memory. The technique includes providing data identifying memory pages and their access characteristics to the virtualization software which then derives the memory access characteristics from the specified data. Optionally, the program may also specify a pre-defined function to be performed upon the occurrence of a fault associated with access to an identified memory page. In this manner, programs operating both internal and external to the virtualization software can protect his memory pages, without intermediation by the operating system software.